Why don't the commands

gpg2 --armor --sign file.txt


gpg2 --clearsign file.txt

have the same output?

Also when I use just --sign I get a bunch of binary gibberish surrounding the message in plaintext, however using the options --armor --sign spits out ASCII text with no plaintext message.

What's going in the background here?


With --sign, the message data is encapsulated in a container which also includes the signature value. The container formally consists in bytes, which cannot all be mapped to printable characters: that's your "binary gibberish surrounding the message". This "container" is what is described in RFC 4880. By using --armor, you instruct GnuPG to apply Base64 encoding on all these bytes (the complete container, including the contained data) into printable characters. The result is indeed in ASCII (that's the point of Base64), but not immediately readable by a human being: with Base64, any three bytes become four characters.

With --clearsign, the message data is not encapsulated in the same kind of container. Instead, it is an ASCII-based container, which consists in:

  • A header line (-----BEGIN PGP SIGNED MESSAGE-----).
  • The (mostly) unmodified message data (end-of-line characters are normalized).
  • The cryptographic signature itself, which is binary, then encoded in Base64 and equipped with distinctive header lines.

The --clearsign option is similar to computing a "detached" signature (a signature object which does not contain a copy of the signed data), then gluing the signature to the original message with some ASCII-compatible headers, so that the original message remains readable to the naked eye. This is the mode recommended for unencrypted, signed emails, so that recipients who do not know or care about PGP can still read the emails.

  • So the output from --sign --armor has been encoded but not encrypted, correct? So the message can be pulled out without access to my public key (however the signature could not be checked)? – Yelneerg Jul 24 '14 at 14:04
  • Yes, with --sign you sign but you do not encrypt. Distinct operations. The --armor is not about encryption (as in: hiding information from people who don't know some specific key) but about surviving alterations in transit (as in: some email server will convert LF end-of-line characters to CR+LF, or will replace what it supposes to be an "unprintable character" with a "?"). The "armoring" is about coping with the careless way email servers handle emails. On a similar note, Base64 is also internally used when you send a binary attachment, for pretty much the same reason. – Tom Leek Jul 24 '14 at 15:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.